@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.24

package/scripts/lib/active_delivery.rb

@@ -0,0 +1,105 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "yaml"
+require_relative "lock"
+
+# ActiveDelivery (intent 340b, G7c, n4, D10): which intent a session is
+# delivering. A lock is a file inside an intent directory, and intents live
+# under the global store or under any configured project's store, so
+# answering "which intent" needs a walk, not an index the way node_ids.rb
+# indexes ids: one Dir.glob per configured root (plus one for the global
+# store) and one JSON parse per candidate lock file. No validator, no graph
+# rebuild, nothing else touches disk. Shared by StopGate (the fourth arming
+# condition needs to know the lock's run_mode) and Handoff (the Runner
+# section needs to know which intent's runner-step.last to render).
+#
+# Pure and dependency-injected: every call takes explicit paths; nothing
+# here reads ENV, shells out, or raises across its own boundary.
+module ActiveDelivery
+  module_function
+
+  # resolve(global_store:, project_roots:, session:, ttl:, now:) -> intent_dir or nil.
+  # Nil for zero matches or more than one: a session holding two live locks
+  # at once is a state nothing downstream may guess through (row 4.25).
+  def resolve(global_store:, project_roots:, session:, ttl: Lock::TTL_SECONDS, now: Time.now)
+    held = candidate_intent_dirs(global_store: global_store, project_roots: project_roots)
+           .uniq
+           .select { |dir| held_live?(dir, session: session, ttl: ttl, now: now) }
+    held.size == 1 ? held.first : nil
+  end
+
+  # Every intent directory under the global store or a configured project
+  # root that carries a delivery.lock file, unparsed. One Dir.glob per root
+  # (row 4.27): the global store's intents sit directly under store/, a
+  # project root's intents sit two levels down, under <root>/<slug>/store/.
+  def candidate_intent_dirs(global_store:, project_roots:)
+    dirs = []
+    dirs.concat(Dir.glob(File.join(global_store.to_s, "*", "delivery.lock"))) unless blank?(global_store)
+    Array(project_roots).each do |root|
+      next if blank?(root)
+
+      dirs.concat(Dir.glob(File.join(root.to_s, "*", "store", "*", "delivery.lock")))
+    end
+    dirs.map { |lock_path| File.dirname(lock_path) }
+  end
+
+  # Live and held by this session: a fresh (non-expired) lock whose owner or
+  # delegate list names this session. A torn or unparseable lock is skipped,
+  # never raised (row 4.26): a module a hook depends on must fail as quietly
+  # as the hook itself does.
+  def held_live?(intent_dir, session:, ttl:, now:)
+    return false unless Lock.fresh?(intent_dir, ttl: ttl, now: now)
+
+    Lock.holds?(intent_dir, session: session)
+  rescue StandardError
+    false
+  end
+
+  def blank?(value)
+    value.nil? || value.to_s.strip.empty?
+  end
+
+  DEFAULT_PROJECT_ROOTS = ["~/.plastic/projects"].freeze
+
+  # The configured project roots (344 n2, D6): the `project_roots` list in
+  # `<plastic_home>/config.yml`, each expanded, or the default
+  # `~/.plastic/projects` when the key is absent or the file cannot be read
+  # or parsed. Never raises: a broken config.yml must never crash a hook on
+  # every prompt.
+  def project_roots(plastic_home)
+    path = File.join(plastic_home.to_s, "config.yml")
+    data = File.exist?(path) ? YAML.safe_load(File.read(path)) : nil
+    roots = data.is_a?(Hash) ? data["project_roots"] : nil
+    roots = DEFAULT_PROJECT_ROOTS unless roots.is_a?(Array) && !roots.empty?
+    roots.map { |root| File.expand_path(root.to_s) }
+  rescue StandardError
+    DEFAULT_PROJECT_ROOTS.map { |root| File.expand_path(root) }
+  end
+
+  # resolve_by_short_session(...) -> intent_dir or nil (344 n2). The tmp dir
+  # name is the short session id, while lock owners and delegates carry full
+  # ids, so this matches a lock whose owner or a delegate session STARTS WITH
+  # the short id. Nil for zero or more than one match, mirroring resolve's
+  # own uniqueness rule: an ambiguous short id names nothing downstream may
+  # guess through.
+  def resolve_by_short_session(global_store:, project_roots:, short_session:,
+                               ttl: Lock::TTL_SECONDS, now: Time.now)
+    held = candidate_intent_dirs(global_store: global_store, project_roots: project_roots)
+           .uniq
+           .select { |dir| held_live_by_short?(dir, short_session: short_session, ttl: ttl, now: now) }
+    held.size == 1 ? held.first : nil
+  end
+
+  def held_live_by_short?(intent_dir, short_session:, ttl:, now:)
+    return false unless Lock.fresh?(intent_dir, ttl: ttl, now: now)
+
+    data = Lock.read(intent_dir)
+    return false unless data.is_a?(Hash)
+
+    sessions = [data["owner_session"]] + Array(data["delegates"])
+    sessions.compact.map(&:to_s).any? { |session| session.start_with?(short_session.to_s) }
+  rescue StandardError
+    false
+  end
+end

package/scripts/lib/agent_models.rb

@@ -10,9 +10,18 @@
 module AgentModels
   # Claude Code aliases only (never pinned ids, never Fable). Keys are the agent
   # file basenames without the `.md` extension.
+  # The three per-kind node agents (intent 340b, G7c, n2), dispatched by
+  # HarnessAdapter::AGENT_TYPE_BY_KIND. work and research resolve the
+  # executor tier, verify the advisor tier, mirroring RunnerPolicy's
+  # model_role split (327 D12): work and research run on plastic-executor's
+  # own tier, verify on the same tier plastic-advisor's imitation
+  # (plastic-faux-advisor) ships, never the cheap tier.
   TIER_DEFAULTS = {
     "plastic-enforcer" => "opus",
-    "plastic-executor" => "sonnet"
+    "plastic-executor" => "sonnet",
+    "plastic-node-work" => "sonnet",
+    "plastic-node-verify" => "opus",
+    "plastic-node-research" => "sonnet"
   }.freeze
 
   # The two advisor agents (intent 185 final design): plastic-advisor (the real

package/scripts/lib/arm.rb

@@ -10,13 +10,14 @@ require_relative "savepoint"
 
 # Arm - how an auto team takes an intent and gives it back (intent 307).
 #
-# Three durable facts make a delivery: the delivery lock in the intent
-# directory (who owns it), the code worktree under the project repo (where
-# the code lands), and the per-session pointer in the global store's `.tmp/`
-# (which intent this session records into; a day id means the day ledger).
-# Before 2.0 a fourth thing, a `/tmp` bridge JSON, cached all three plus a
-# stage snapshot; ruling 6 of intent 296 retired it, and this module is what
-# replaced the bridge's arm, disarm, and repair methods (removed in 2.0, intent 307).
+# Two durable facts make a delivery: the delivery lock in the intent
+# directory says who delivers, and the code worktree under the project repo
+# says where the code lands. A conversation session's tmp directory under
+# the global store's `.tmp/` says only that a session started; it names no
+# intent. This module carries the
+# arm, disarm, and repair operations (intent 307); the pure INDEX/project-config
+# helpers that once sat alongside them on a shared-helpers module now live on
+# IndexEntry and ProjectConfig (intent 344).
 #
 # Pure and dependency-injected: every path and clock is an argument, every git
 # call goes through an injected runner, and the only environment read is the
@@ -32,7 +33,7 @@ module Arm
   end
 
   # Deterministic, session-less key derived from the store and the intent id,
-  # for headless runs that carry no session id at all (moved from Bridge).
+  # for headless runs that carry no session id at all.
   def derive_key(store, intent_id)
     "auto-" + Digest::SHA256.hexdigest("#{store}/#{intent_id}")[0, 10]
   end
@@ -67,7 +68,7 @@ module Arm
 
   # The minimal hash Worktree.provision, release, and finish consume: the
   # intent block plus, when asked, the derived worktree block.
-  def bridge_hash(intent_dir:, home: Dir.home, with_worktree: true)
+  def delivery(intent_dir:, home: Dir.home, with_worktree: true)
     dir = File.expand_path(intent_dir)
     data = {
       "intent" => { "id" => intent_id_for(dir), "dir" => File.basename(dir), "store" => store_for(dir) },
@@ -94,48 +95,26 @@ module Arm
     }
   end
 
-  # Owner rule 2026-08-31: does this session already have a live top-level
-  # pointer pointing SOMEWHERE ELSE (the day ledger or another intent)? A
-  # pointer already on this intent is the owner re-arming mid-delivery and
-  # stays idempotent. True means a
-  # conversation session. Reads only; rescues to false (fail open).
-  def preexisting_pointer?(session, home:)
-    path = pointer_path(session, home: home)
-    File.exist?(path) && !File.read(path).to_s.strip.empty?
+  # Owner rule 2026-08-31: has this session already started a conversation?
+  # A conversation session's tmp directory is made at boot under the global
+  # store's `.tmp/`; a dispatched or headless session (a derived key) never
+  # gets one. Reads only; rescues to false (fail open: a broken store must
+  # never block a legitimate delivery).
+  def started_session?(session, home:)
+    store = global_store(home)
+    Dir.exist?(SessionLedger.session_tmp_dir(store, SessionLedger.short_session_id(nil, session)))
   rescue StandardError
     false
   end
 
-  # --- the pointer -------------------------------------------------------------
-
-
-  def pointer_path(session, home:)
-    store = global_store(home)
-    SessionLedger.pointer_path(store, SessionLedger.short_session_id(nil, session))
-  end
-
-  def read_pointer(session, home:)
-    path = pointer_path(session, home: home)
-    File.exist?(path) ? File.read(path).strip : nil
-  end
-
-  def write_pointer(session, value, home:)
-    store = global_store(home)
-    SessionLedger.ensure_tmp_root(store)
-    path = pointer_path(session, home: home)
-    FileUtils.mkdir_p(File.dirname(path))
-    File.write(path, "#{value}\n")
-    path
-  end
-
   # --- arm ---------------------------------------------------------------------
 
   # Take an intent for `session`: acquire delivery.lock (stamped with the run
-  # mode and the provenance the caller knows), provision the code worktree
-  # (fail-open for a global-only or non-git intent), and point the session at
-  # the intent. Returns `{status:, lock:, worktree:, session:, pointer:}`.
-  # A held, stale, excluded, or corrupt lock returns that status with the
-  # lock data read and touches nothing.
+  # mode and the provenance the caller knows) and provision the code worktree
+  # (fail-open for a global-only or non-git intent). Returns
+  # `{status:, lock:, worktree:, session:}`. A held, stale, excluded, or
+  # corrupt lock returns that status with the lock data read and touches
+  # nothing.
   def arm(intent_dir:, session:, mode: "auto", home: Dir.home, harness: nil,
           agent: nil, model: nil, thread: nil, now: Time.now, runner: Worktree::ShellRunner.new,
           host: Socket.gethostname, allow_inline: false)
@@ -145,52 +124,39 @@ module Arm
     h = home_for(dir, home: home)
 
     # Owner rule 2026-08-31: the main session never delivers an intent inline.
-    # A session that already carries a top-level session pointer is a
-    # conversation session (SessionStart wrote it at boot); arming there is
-    # inline delivery and is refused BEFORE any lock is taken. A dispatched or
-    # headless session has no pre-existing pointer and arms freely.
-    # --allow-inline is the explicit owner override. Fail open on read errors:
-    # a broken pointer file must never block a legitimate delivery.
-    if !allow_inline && preexisting_pointer?(key, home: h) &&
-       read_pointer(key, home: h).to_s.strip != intent_id_for(dir)
-      return { status: :inline_refused, lock: nil, worktree: nil, session: key, pointer: nil }
+    # A conversation session (its tmp directory already exists under the
+    # global store) arming an intent it does not already hold the lock for is
+    # inline delivery and is refused BEFORE any lock is taken. Re-arming the
+    # intent it already holds stays idempotent. A dispatched or headless
+    # session has no tmp directory and arms freely. --allow-inline is the
+    # explicit owner override.
+    if !allow_inline && started_session?(key, home: h) && !Lock.holds?(dir, session: key)
+      return { status: :inline_refused, lock: nil, worktree: nil, session: key }
     end
 
     status, lock = Lock.acquire(dir, session: key, host: host, now: now,
                                 harness: harness, agent: agent, model: model,
                                 thread: thread, run_mode: mode.to_s)
     unless %i[acquired owned].include?(status)
-      return { status: status, lock: lock, worktree: nil, session: key, pointer: nil }
+      return { status: status, lock: lock, worktree: nil, session: key }
     end
 
-    data = bridge_hash(intent_dir: dir, home: h, with_worktree: false)
+    data = delivery(intent_dir: dir, home: h, with_worktree: false)
     begin
       Worktree.provision(data, home: h, runner: runner)
     rescue StandardError => e
       warn "plastic: worktree provision raised, continuing unprovisioned: #{e.message}"
     end
 
-    # The pointer is what the capture and record hooks read; they key on the
-    # harness's real session id, so a derived key gets no pointer (nothing would
-    # ever read it). A pointer failure warns and never undoes an acquired lock.
-    pointer = nil
-    unless key == derive_key(store_for(dir), intent_id_for(dir))
-      begin
-        pointer = write_pointer(key, intent_id_for(dir), home: h)
-      rescue StandardError => e
-        warn "plastic: session pointer not written (#{e.message}); the lock is held regardless"
-      end
-    end
     { status: status, lock: lock, worktree: worktree_block(intent_dir: dir, home: h),
-      session: key, pointer: pointer }
+      session: key }
   end
 
   # --- disarm ------------------------------------------------------------------
 
-  # Give the intent back: remove the worktree (when `remove`), release the
-  # lock as its recorded owner (falling back to `session`), and reset the
-  # session pointer to today's day id when it named this intent. Returns
-  # the lock release status (:released, :none, :not_owner, or :raised).
+  # Give the intent back: remove the worktree (when `remove`) and release the
+  # lock as its recorded owner (falling back to `session`). Returns the lock
+  # release status (:released, :none, :not_owner, or :raised).
   def disarm(intent_dir:, session:, home: Dir.home, runner: Worktree::ShellRunner.new,
              remove: true, now: Time.now)
     dir = File.expand_path(intent_dir)
@@ -198,39 +164,24 @@ module Arm
     key = resolve_session(session, store: store_for(dir), intent_id: intent_id_for(dir))
 
     begin
-      Worktree.release(bridge_hash(intent_dir: dir, home: h), home: h, runner: runner, remove: remove)
+      Worktree.release(delivery(intent_dir: dir, home: h), home: h, runner: runner, remove: remove)
     rescue StandardError => e
       warn "plastic: worktree release raised, continuing: #{e.message}"
     end
 
     lock = Lock.read(dir)
     owner = lock && !blank?(lock["owner_session"]) ? lock["owner_session"] : key
-    release_status = begin
+    begin
       Lock.release(dir, session: owner)
     rescue StandardError => e
       warn "plastic: delivery lock release raised for #{dir}, continuing: #{e.message}"
       :raised
     end
-
-    begin
-      reset_pointer(key, intent_id_for(dir), home: h, now: now)
-    rescue StandardError => e
-      warn "plastic: session pointer not reset (#{e.message})"
-    end
-    release_status
-  end
-
-  # Point the session back at the day ledger, but only when it names `intent_id`.
-  def reset_pointer(session, intent_id, home:, now: Time.now)
-    current = read_pointer(session, home: home)
-    return false unless current == intent_id.to_s
-    write_pointer(session, SessionLedger.day_id(now), home: home)
-    true
   end
 
   # --- repair ------------------------------------------------------------------
 
-  # One idempotent repair (the lock half of the bridge's repair, removed in 2.0):
+  # One idempotent repair (the lock half of the repair path):
   # remove a corrupt lock, back off from a fresh foreign lock (`held`), report
   # a stale foreign lock (`stale`) for the explicit reclaim verb, keep and
   # enrich an own lock, heartbeat a delegated one, acquire when none, and
@@ -284,7 +235,7 @@ module Arm
     end
 
     begin
-      Worktree.provision(bridge_hash(intent_dir: dir, home: h, with_worktree: false), home: h, runner: runner)
+      Worktree.provision(delivery(intent_dir: dir, home: h, with_worktree: false), home: h, runner: runner)
     rescue StandardError => e
       warn "plastic: worktree provision raised during repair, continuing unprovisioned: #{e.message}"
     end
@@ -293,16 +244,4 @@ module Arm
 
     { "status" => "repaired", "actions" => actions, "lock" => lock_data, "session" => key }
   end
-
-  # The intent directory this session's pointer names, searched in the given
-  # stores in order; nil when the pointer is absent, empty, or a day id.
-  def intent_dir_from_pointer(session, home:, stores:)
-    current = read_pointer(session, home: home)
-    return nil if blank?(current) || SessionLedger.valid_day_id?(current)
-    stores.each do |store|
-      match = Dir.glob(File.join(store, "#{current}--*")).find { |p| File.directory?(p) }
-      return match if match
-    end
-    nil
-  end
 end

package/scripts/lib/codex_adapter.rb

@@ -0,0 +1,197 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "yaml"
+require "timeout"
+require "tmpdir"
+require_relative "runner_policy"
+
+# CodexAdapter (intent 340b, G7c, n6): the argv `codex exec` needs for one
+# node's kind, and the mechanics of running it once - a bounded subprocess
+# whose stdin carries the node input, whose stdout and `--output-last-message`
+# file are the only two places a return can come from, and whose timeout
+# kills the whole process group rather than one pid.
+#
+# Pure where it can be: sandbox_mode, git_dir_for_worktree, add_dir_args and
+# build_argv touch nothing but the filesystem read they are explicitly given
+# (the worktree's own `.git` file), never a git call and never a guess at a
+# repository root. #execute is the one place this module actually spawns a
+# child process; scripts/node-run is the only caller.
+module CodexAdapter
+  module_function
+
+  # Verify and research get NO write access at all (spec D9): read-only, no
+  # `--add-dir`. Everything else - work, and any kind this table has never
+  # heard of - gets the widest treatment, matching RunnerPolicy's own
+  # unknown-kind-falls-back-to-work rule (matrix row 6.10).
+  READ_ONLY_KINDS = %w[verify research].freeze
+
+  def sandbox_mode(kind)
+    READ_ONLY_KINDS.include?(kind.to_s) ? "read-only" : "workspace-write"
+  end
+
+  # The repository's OWN `.git` directory, derived from `worktree`'s `.git`
+  # FILE (a git worktree never carries a real `.git` directory of its own -
+  # spec) rather than any guess at how many path segments separate a
+  # worktree from its repo (matrix row 6.6). `.git` reads
+  # `gitdir: <repo>/.git/worktrees/<name>`; two directories up from that
+  # target is the repository's real `.git`. Returns nil when `worktree` is
+  # not a git worktree at all (no `.git` file, or `.git` is a directory,
+  # meaning `worktree` is a repository's own primary checkout) - callers
+  # treat that as "no `--add-dir` to add", never as a reason to guess.
+  def git_dir_for_worktree(worktree)
+    gitfile = File.join(worktree.to_s, ".git")
+    return nil unless File.file?(gitfile)
+
+    content = File.read(gitfile)
+    m = content.match(/\Agitdir:\s*(.+?)\s*\z/m)
+    return nil unless m
+
+    worktrees_entry = File.expand_path(m[1], worktree.to_s)
+    File.dirname(File.dirname(worktrees_entry))
+  end
+
+  # [] for a read-only kind (matrix row 6.4): `-C` already makes the
+  # worktree writable, and `--add-dir` on top of `--sandbox read-only` would
+  # contradict the sandbox mode itself. Exactly one `--add-dir`, the
+  # repository's own `.git`, for every other kind (matrix row 6.5) - nil
+  # when the worktree's own gitdir pointer cannot be resolved, so a caller
+  # handed a plain (non-worktree) directory never gets a bogus argument.
+  def add_dir_args(kind:, worktree:)
+    return [] if READ_ONLY_KINDS.include?(kind.to_s)
+
+    git_dir = git_dir_for_worktree(worktree)
+    git_dir ? ["--add-dir", git_dir] : []
+  end
+
+  # The whole `codex exec` argv for one node (matrix rows 6.1-6.9): `-C` at
+  # the worktree given (row 6.8), the sandbox mode and `--add-dir` this
+  # kind's row calls for and nothing else (row 6.7 - never the intent
+  # worktree, never `~/.plastic`), `--output-last-message` at the path the
+  # caller names, and a bare `-` so the prompt is read from stdin (row 6.9) -
+  # the node input itself never rides in this array.
+  def build_argv(kind:, worktree:, output_last_message:)
+    [
+      "codex", "exec",
+      "-C", worktree.to_s,
+      "--sandbox", sandbox_mode(kind),
+      *add_dir_args(kind: kind, worktree: worktree),
+      "--output-last-message", output_last_message.to_s,
+      "-",
+    ]
+  end
+
+  # matrix row 6.23: the wall-clock bound comes from the KIND's own lease
+  # length (RunnerPolicy.lease_minutes), never one shared constant - a long
+  # `work` build must not be capped as tightly as a quick `verify` pass.
+  def timeout_seconds(kind)
+    RunnerPolicy.lease_minutes(kind) * 60
+  end
+
+  # The return text (matrix rows 6.18/6.19): `output_last_message_path`'s
+  # own content when it exists and is non-blank (row 6.18 - stdout is never
+  # even inspected on this path), else the last YAML document found in
+  # `stdout` (row 6.19), else nil (no return anywhere - row 6.20 is the
+  # caller's problem, not this method's).
+  def read_return(output_last_message_path:, stdout:)
+    from_file = file_present_content(output_last_message_path)
+    return from_file unless from_file.nil?
+
+    stdout_fallback(stdout)
+  end
+
+  # The LAST YAML document in `text` that parses to a mapping, or nil when
+  # none does (row 6.20's other half). Documents are separated the ordinary
+  # YAML way, a line holding only `---`; a stream with no such separator at
+  # all is treated as one candidate document. Every candidate is tried from
+  # the end, so three documents (one row names explicitly) still resolve to
+  # the last one, and prose or a fragment that never parses to a mapping is
+  # skipped rather than returned as the "document".
+  def stdout_fallback(text)
+    return nil if text.to_s.strip.empty?
+
+    segments = text.to_s.split(/^---[ \t]*$/m).map(&:strip).reject(&:empty?)
+    segments = [text.to_s.strip] if segments.empty?
+
+    segments.reverse_each do |segment|
+      return segment if safe_yaml(segment).is_a?(Hash)
+    end
+    nil
+  end
+
+  # Runs `argv` once, feeding `stdin_data` on stdin through a scratch file
+  # (never a pipe - the same "never deadlock the read side" reasoning
+  # HookReplay.run_bounded already carries), bounded to `timeout_seconds`.
+  # `argv`'s own child becomes its own process group (`pgroup: true`) so a
+  # timeout can kill every child `codex exec` spawned along the way, not
+  # just the pid this call started (matrix row 6.24) - `codex exec` itself
+  # spawns shells for the commands it runs, and those would otherwise
+  # outlive a plain `Process.kill` on the parent alone, holding the
+  # worktree.
+  #
+  # Returns {exit_code:, timed_out:, stdout:, message:}. `message` is
+  # #read_return's result, computed only when the call did not time out - a
+  # timed-out child's partial output is never trusted (matrix row 6.22).
+  def execute(argv, stdin_data:, timeout_seconds:, output_last_message_path:)
+    Dir.mktmpdir("plastic-node-run-") do |scratch|
+      in_path = File.join(scratch, "stdin")
+      out_path = File.join(scratch, "stdout")
+      err_path = File.join(scratch, "stderr")
+      File.binwrite(in_path, stdin_data.to_s)
+
+      pid = Process.spawn(*argv.map(&:to_s), in: in_path, out: out_path, err: err_path, pgroup: true)
+      timed_out = false
+      exit_code =
+        begin
+          Timeout.timeout(timeout_seconds) do
+            Process.wait(pid)
+            $?.exitstatus
+          end
+        rescue Timeout::Error
+          timed_out = true
+          kill_group(pid)
+          nil
+        end
+
+      stdout = File.exist?(out_path) ? File.read(out_path) : ""
+      message = timed_out ? nil : read_return(output_last_message_path: output_last_message_path, stdout: stdout)
+
+      { exit_code: exit_code, timed_out: timed_out, stdout: stdout, message: message }
+    end
+  end
+
+  # --- internals ---------------------------------------------------------------
+
+  def file_present_content(path)
+    return nil if path.nil? || !File.exist?(path)
+
+    content = File.read(path)
+    content.strip.empty? ? nil : content
+  end
+  private_class_method :file_present_content
+
+  def safe_yaml(text)
+    YAML.safe_load(text, aliases: false, permitted_classes: [])
+  rescue Psych::Exception, ArgumentError
+    nil
+  end
+  private_class_method :safe_yaml
+
+  # Kills the whole process GROUP `pid` leads, not just `pid` itself (matrix
+  # row 6.24): a negative pid signals the group. Rescued and reaped exactly
+  # like HookReplay.kill_and_reap - a process that exited in the race
+  # between the timeout firing and this call raises Errno::ESRCH on the kill
+  # or Errno::ECHILD on the wait, neither of which should ever propagate.
+  def kill_group(pid)
+    Process.kill("KILL", -pid)
+  rescue StandardError
+    nil
+  ensure
+    begin
+      Process.wait(pid)
+    rescue StandardError
+      nil
+    end
+  end
+  private_class_method :kill_group
+end

package/scripts/lib/{packet_wrapper.rb → data_boundary.rb}

@@ -3,13 +3,13 @@
 
 require "digest"
 
-# PacketWrapper (intent 338, G5, n1): the trust boundary a node packet is
+# DataBoundary (intent 338, G5, n1): the trust boundary a node input is
 # built over. A data block carries text other agents and the owner wrote,
 # and is opened by `<<<PLASTIC-DATA:<token> label="..." source="...">>>` and
 # closed by `<<<END-PLASTIC-DATA:<token>>>`. The token is content-derived
 # (spec D4), so the same payloads always produce the same token and the
-# packet stays deterministic; the escaping rule (spec D5) runs on every
-# payload independently of the token, so a payload carrying this packet's
+# node input stays deterministic; the escaping rule (spec D5) runs on every
+# payload independently of the token, so a payload carrying this node input's
 # own closing marker still cannot close its block. Attribute values
 # (`label`, `source`) are sanitized separately, by a whitelist (spec D5a),
 # because they are not payload text and the payload escaping rule does not
@@ -18,7 +18,7 @@ require "digest"
 # Pure and side-effect-free: no I/O, no clock, nothing raised across the
 # boundary. `estimate_tokens` is the one arithmetic every budget in this
 # delivery is spent in (spec D6): bytes over four, rounded.
-module PacketWrapper
+module DataBoundary
   module_function
 
   MARKER_OPEN = "<<<PLASTIC-DATA:"
@@ -34,16 +34,16 @@ module PacketWrapper
   CLOSE_LINE_RE = /\A#{Regexp.escape(MARKER_CLOSE)}([0-9a-f]+)>>>\z/.freeze
 
   # The first twelve hex characters of the SHA-256 over the payloads joined
-  # by a newline (spec D4): fixed per packet, unguessable from any single
+  # by a newline (spec D4): fixed per node input, unguessable from any single
   # record file, deterministic across two builds of the same payloads.
   def boundary_token(payloads)
     Digest::SHA256.hexdigest(Array(payloads).map(&:to_s).join("\n"))[0, 12]
   end
 
   # One-way marker escaping (spec D5), plus a UTF-8 scrub (matrix 1.10) so
-  # one invalid byte anywhere in a record never raises the whole packet
+  # one invalid byte anywhere in a record never raises the whole node input
   # build. Runs regardless of what token trails the marker text, because a
-  # payload copied from an earlier packet may carry ANY token, not only this
+  # payload copied from an earlier node input may carry ANY token, not only this
   # one (matrix 1.2's concern applied to escaping rather than to the token
   # itself).
   def escape(payload)